Over the last few years I've had to turn away a few customers from countries like Iran, Russia and China because either a BIS license was required due to general EAR restrictions on cyber products to those countries, or the entity was actually on the BIS Entity list. Have you experienced this? How do you handle it?

In some sense it sucks because the markets of some of these countries are large, and there may be people in those countries who want it for legitimate reasons (Freedom, etc). At the same time, you have to obey the law and respect sanctions. They have a legitimate purpose. That's non negotiable. Any cybersecurity people have experience with this kind of scenario?

Technically it's possible to apply for licenses, but if the status is "presumption of denial", or even if it's not, the process is a massive hassle for tiny product companies that just want to build stuff.

I'm not losing sleep over this stuff - but it doesn't feel great - and I'm just curious of others' experiences in US corporations (not sure if EU has similar).